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Executive  Summary 


Title :  AFGHANISTAN:  ‘ GREEN-ON-BLUE ’  ATTACKS 
Author:  Major  David  A.  Arenas,  United  States  Marine  Corps 

Thesis:  The  rise  of  green-on-blue  attacks  in  Afghanistan  is  a  disturbing  development  that  can 
have  serious  implications  for  a  peaceful  transition  to  an  Afghan  lead  security  force. 

Discussion:  Green-on-blue  attacks  by  members  of  the  Afghan  National  Security  Force  (ANSF) 
against  International  Security  Assistance  Force  (ISAF)  personnel  have  claimed  144  lives 
between  2007  and  2013.  The  possible  solutions  to  the  joint  ISAF  and  ANSF  problem  will 
require  continuous  assessment  in  order  to  mitigate  the  green-on-blue  threat,  reduce  potential 
adverse  effect  on  ISAF  exit  strategy,  and  maintain  confidence  in  the  campaign.  The  green-on- 
blue  threat  will  remain,  whether  through  cultural  indifference  or  as  an  insurgent  tactic  for 
propaganda.  The  rapid  expansion,  faulty  recruitment,  inadequate  training  and  hasty 
operationalization  of  ANSF,  has  made  the  security  situation  in  Afghanistan  complex. 

Conclusion:  The  further  rise  in  green-on-blue  attacks  has  eroded  the  trust  between  the  ANSF 
and  ISAF,  adversely  affected  training  and  mentoring,  and  has  led  to  the  suspension  or  limited 
joint  operations;  as  demonstrated  in  August  of  2012  with  the  U.S.  decision  to  suspend  recruit 
training  for  Afghan  Local  Police  and  joint  field  operations.  NATO  allies  have  debated 
accelerated  troop  withdrawals,  which  could  affect  the  2014  NATO  strategy.  The  continued 
emphasize  on  force  size,  rather  than  quality  of  forces  will  likely  remain  as  the  ANSF  grows. 
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Preface 


In  the  last  12  months,  Afghan  forces  killed  one  in  every  seven  North  Atlantic  Treaty 
Organization  (NATO)  soldiers  serving  in  Afghanistan. 1  Seventy-six  green-on-blue  attacks  have 
taken  place,  the  number  of  Coalition  casualties  from  green-on-blue  attacks  for  the  period  May  7, 
2007  to  the  present  is  144,  and  the  number  of  Coalition  wounded  is  168.  These  attacks  have 
provoked  a  lack  of  trust  and  confidence  and  have  led  to  restricted  and  limited  interaction 
between  International  Security  Assistance  Force  (ISAF)  and  Afghanistan  National  Security 
Forces  (ANSF).  More  than  just  insurgent  infiltration  into  ANSF,  indicators  exist  that  many  of 
the  green-on-blue  attacks  result  from  cultural  and  personal  differences.  In  an  effort  to  bolster 
support,  the  Taliban  usually  claim  responsibility  for  these  attacks,  though  they  account  for  few 
green-on-blue  incidents.3  Estimates  are  about  40  percent  of  these  incidents  are  caused  by  stress 
of  various  kinds,  15  percent  are  due  to  pressure  from  the  Taliban,  10  percent  are  caused  by 
Taliban  disguised  as  ANSF  members,  and  35  percent  has  not  been  definitively  determined.4 

Green-on-blue  attacks  in  Afghanistan  are  a  disturbing  development  that  can  have  serious 
implications  for  a  peaceful  transition  to  an  Afghan  lead  security  force.  The  threat  of  green-on- 
blue  attacks  suggests  that  ISAF  along  with  ANSF  need  to  be  discerning  about  recruitment  into 
the  Afghan  security  forces.  The  insurgent’s  ability  to  carry  out  attacks  through  infiltration  or  co¬ 
option  provides  fuel  for  propaganda,  in  an  effort  to  spread  distrust  between  ISAF  and  ANSF 
members  and  erode  confidence  to  the  ISAF  campaign  strategy. 
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Introduction 


A  NATO  conference  in  January  2013  identified  Green-on-blue  attacks  as  the  number-one 
strategic  risk  in  Afghanistan  and  training  to  mitigate  the  threat  was  the  priority  for  the  members 
of  the  International  Security  Assistance  Force.  5  General  Dunford  described  the  spike  in  green- 
on-blue  attacks  as  an  insider  tactic  to  create  a  seam  between  ISAF  and  the  ANSF,  sowing 
mistrust  between  partners  and  undermining  domestic  support  for  the  campaign.6  The  current  rise 
in  green-on-blue  incidents,  reflect  the  decision  of  several  coalition  partners,  most  notably  of 
France  under  its  new  President  Francois  Hollande,  and  of  New  Zealand,  to  withdraw  their 
combat  troops  before  the  previously  declared  deadlines.  7 

During  the  month  of  August  2012,  these  attacks  were  the  leading  cause  of  US  deaths. 
“I’m  mad  as  hell  about  them,  to  be  honest  with  you,”  Gen.  John  Allen  said  on  CBS’s  ‘60 
Minutes’.  “We’re  going  to  get  after  this.  It  reverberates  everywhere,  across  the  United  States. 

You  know,  we’re  willing  to  sacrifice  a  lot  for  this  campaign.  But  we’re  not  willing  to  be 

o 

murdered  for  it.”  These  attacks  question  the  administration’s  strategy,  to  train  and  build  a 
capable  and  dependable  Afghan  force  able  to  maintain  security  and  prevent  the  return  of  the 
Taliban  and  al-Qadea  once  forces  have  departed.  “These  attacks  are  sad.  This  is  something  that 
I’ve  discussed  in  detail,  something  I  bear  responsibility  to  correct,”  Karzai  said  on  “60  Minutes.9 

The  rise  of  green-on-blue  attacks  in  Afghanistan  is  a  disturbing  development  that  can 
have  serious  implications  for  a  peaceful  transition  to  an  Afghan  lead  security  force.  The  threat  of 
green-on-blue  attacks  suggests  that  ISAF  along  with  ANSF  need  to  be  discerning  about 
recruitment  into  the  Afghan  security  forces.  The  insurgent’s  ability  to  carry  out  attacks  through 
infiltration  or  co-option  provides  fuel  for  propaganda,  in  an  effort  to  spread  distrust  between 
ISAF  and  ANSF  members  and  erode  confidence  to  the  ISAF  campaign  strategy. 
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Research  Question 

The  purpose  of  this  study  is  to  gain  insight  into  the  motivations  behind  green-on-blue 
attacks  and  its  effect  on  the  NATO  mission  in  Afghanistan.  The  researcher  has  analyzed  ISAF 
reported  attacks  from  2007-2013  in  order  to  detennine  underlying  themes  and  links  related  to 
green-on-blue  incidents.  The  goal  of  this  study  is  to  conceptualize,  further  understand,  and  unify 
the  various  underlying  factors  to  the  rise  of  green-on-blue  attacks.  The  ultimate  goal  of  the  study 
is  to  assess  the  potential  impact  to  the  ISAF  campaign  strategy,  while  also  revealing  fundamental 
commonalities,  such  as  ethnicity  and  affiliation  with  the  Afghan  security  force  that  will  offer  a 
more  profound  understanding  into  the  rise  of  green-on-blue  attacks. 

This  study  deals  with  the  impact  in  the  rise  of  green-on-blue  incidents  and  its 
implications  for  a  successful  transition  the  Afghan  lead  security.  It  aims  in  detennining  if 
cultural  grievances  influence  or  lend  to  the  rise  of  green-on-blue  attacks.  Identifying  cultural 
based  grievances  that  support  feelings  of  humiliation  and  the  drive  to  restore  honor  as  a  cause  of 
for  an  attack.  Cultural  grievance  incidents  appear  to  elicit  a  more  intense  emotive  reaction 
suggesting  that  ‘acts  of  rage’  rather  than  a  carefully  planned  or  calculated  process  drive  the 
attacks. 

This  study  plans  to  look  at  the  rapid  growth  of  the  ANSF,  especially  comparing  and 
contrasting  ethnic  makeup  of  the  security  forces.  In  addition,  the  study  analyzes  how  green-on- 
blue  attacks  affect  current  ISAF  and  ANSF  interactions  and  the  transition  to  an  Afghan  led 
security  force. 

An  empirical  analysis  of  patterns  and  trends  in  reporting  of  green-on-blue  attacks  in 
relation  to  data  on  the  growth  of  ANSF  indicates  a  possible  connection  between  ethnicity  and 
attacks.  Specifically,  Pashtuns  in  the  ANA  account  for  a  disproportionate  number  of  attacks. 
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These  attacks  predominantly  occur  on  base  further  implying  that  the  attacks  are  a  sign  of 
successful  insurgent  infiltration  into  the  ANSF. 

This  study  relies  on  variety  of  outside  military  resources  and  ISAF  unclassified  reports, 
due  to  the  relatively  recent  nature  of  green-on-blue  incidents  there  is  a  lack  of  military  research 
and  writing  on  the  topic.  In  order  to  understand  the  definition  and  parameters  that  contribute  to 
green-on-blue  attacks,  the  researcher  studied  on  attacks  conducted  between  2007  and  2013.  This 
study  will  include  a  qualitative  analysis  of  reported  green-on-blue  incidents  in  order  to  identify 
motives  and  compare  to  criteria  detennined  necessary  to  conduct  a  green-on-blue  attack. 

There  is  no  doubt  that  many  such  incidents  may  relate,  to  personal  grievances  or  personal 
hostility,  but  there  is  equally  no  doubt  that  in  many  cases  the  attackers  are  Taliban  planted  in  the 
rapidly  expanded  ANSF.  This  report  will  concentrate  on  the  methods  and  tactics  used  by 
insurgents  to  infiltrate  into  the  ANSF.  The  possible  solutions  to  the  joint  ISAF  and  ANSF 
problem  will  require  continuous  assessment  in  order  to  mitigate  the  green-on-blue  threat,  reduce 
potential  adverse  effect  on  ISAF  exit  strategy,  and  maintain  confidence  in  the  campaign.  The 
green-on-blue  threat  will  remain,  whether  through  cultural  indifference  or  as  an  insurgent  tactic 
for  propaganda.  The  rapid  expansion,  faulty  recruitment,  inadequate  training  and  hasty 
operationalization  of  ANSF,  has  made  the  security  situation  in  Afghanistan  complex. 

Scope  and  Methodology 

There  are  limited  ISAF  reports  on  green-on-blue  attacks  or  data  on  the  background  of 
attackers  to  show  how  the  attackers  many  have  been  influenced  by  extremist  propaganda,  and 
how  many  have  been  encouraged  by  insurgents  as  a  target-of-opportunity  or  inserted  as 
infiltrators.  ISAF  reporting  does  not  prove  a  distinction  between  killings  due  to  Taliban 
infiltration  and  killings  due  to  personal  disputes  and  other  reasons.  While  cultural  and  personal 
differences  may  play  a  role  in  the  rise  in  green-on-blue  attacks,  infiltration  and  defections  by 
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Afghan  security  personnel  who  have  decided  to  ingratiate  themselves  with  the  Taliban  by 
attacking  ISAF  members  likely  play  a  far  more  significant  role  in  the  green-on-blue  attacks. 
Without  a  complete  study  of  the  attacks,  including  those  that  do  not  result  in  casualties,  it  is 
impossible  to  have  a  full  understanding  as  to  what  motivates  Afghan  security  personnel  to  turn 
on  their  ISAF  partners.  The  research  draws  to  several  definitive  reasons  behind  each  green-on- 
blue  attack  with  the  resources  available  for  study. 

The  researcher  conducted  the  study  to  determine  the  contextual  information  and 
background  data  that  evolved  into  the  current  green-on-blue  threat.  A  summary  of  data  will 
show  the  number  of  attacks,  the  affiliation  of  the  attacker  (if  known),  the  location/province 
where  the  attack  occurred,  the  number  of  security  forces  killed  or  wounded  in  the  attack,  the 
affiliation  of  those  killed  or  wounded,  and  fate  of  the  attacker.  This  research  examines  the  ISAF 
view  of  green-on-blue  incidents  in  order  to  achieve  greater  understanding  of  these  attacks  and 
determine  what  courses  of  action  the  ISAF  should  pursue  to  mitigate  further  attacks.  Analysis 
will  further  detennine  the  effects  of  historical  ethnic  alliances  with  the  Pashtun  tribes  and  the 
effects  of  recruitment  into  the  ANSF.  There  will  be  a  focused  examination  of  the  impact  of 
NATO  operations  in  Afghanistan  the  potential  influence  to  the  NATO  2014  exit  strategy.  By 
obtaining  data  from  ISAF  press  releases,  foreign  and  US  press  reports,  and  information  obtained 
from  ISAF  personnel,  further  analysis  will  determine  if  the  threat  or  mitigation  practices  put  in 
place  is  improving  or  degrading  the  relationship  between  ANSF  and  ISAF.  The  comprehensive 
analysis  within  this  study  concludes  by  providing  a  series  of  viable  recommendations  for  future 
ISAF  policies  and  strategies  that  could  positively  strengthen  the  ISAF  and  ANSF  relationship 
and  enable  both  forces  to  continue  towards  a  secure  Afghanistan. 

Literature  Review 
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This  brief  review  of  the  literature  provides  an  overview  of  the  research  focused  on  the 
study  of  green-on-blue  incidents  and  the  impact  towards  the  NATO  mission  in  Afghanistan.  The 
literature  reviewed  primarily  includes  numerous  news  articles  and  studies  centered  on  the 
analysis  of  green-on-blue  attacks.  A  review  of  the  literature  conducted  gained  an  understanding 
of  factors  that  may  motivate  a  member  of  the  ANSF  to  commit  a  green-on-blue  attack. 

Additional  references  such  as  published  reports  and  online  sources  concerning  green-on-blue  or 
insider  threats  and  how  attacks  erode  trust,  weaken  mutual  confidence  between  the  ANSF  and 
ISAF,  and  should  the  rise  in  attacks  raise  questions  about  the  NATO  exit  strategy. 

From  2007  to  2013,  there  have  been  78  documented  green-on-blue  attacks.10  It  is 
difficult  to  draw  definitive  conclusions  about  the  principal  causes  of  these  attacks  given  the  small 
total  number  of  incidents,  but  there  seems  to  be  some  discernible  trends.  Based  on  available 
information,  there  were  two  green-on-blue  attacks  in  2007,  two  green-on-blue  attacks  in  2008, 
five  in  2009  and  2010  each,  16  in  201 1,  44  in  2012,  four  in  2013. 11  The  rise  in  Green-on-Blue 
attacks  in  Afghanistan,  have  eroded  the  trust  between  ISAF,  and  the  Afghans  they  are  training 
and  mentoring.  These  attacks  pose  a  clear  threat  to  the  U.S.  and  NATO  exit  strategy  for  the 
Afghan  security  forces  to  assume  security  and  stability  for  their  country.  U.S.  and  NATO 
forces  suspended  joint  field  operations  with  the  Afghans  and  suspended  training  for  new  recruits 
for  a  month  while  Afghan  officials,  working  with  U.S.  Special  Operations  forces  to  "re-vet" 

8,000  Afghan  commandos  and  3,000  Afghan  army  special  forces  soldiers  operation  alongside 
American  Special  Operations  forces.  Even  after  2014  withdrawal  of  U.S.  forces,  trainers  and 
advisers  will  remain  embedded  with  352,000  Afghan  Forces.  If  the  interpersonal  trust  vital  to 
that  strategy  breaks  down,  so  will  the  military  partnership.  Given  the  significant  risk  to  U.S.  and 
NATO  mission  posed  by  green-on-blue  attacks,  it  is  important  to  establish  the  cause  and  context 
of  these  deadly  attacks.  One  of  NATO’s  goals  in  Afghanistan  is  to  enable  ISAF  conduct  security 
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and  stability  operations  throughout  the  country  together  with  the  ANSF  and  train  and  develop  the 

1  T 

Afghan  forces. 

Green-on-blue  or  insider  attacks  are  when  Afghanistan  National  Security  Forces,  or  those 
disguised  as  security  forces,  attack  International  Security  Assistance  Force  (ISAF)  personnel 
serving  in  Afghanistan.  The  ISAF  conducts  operations  in  Afghanistan  to  reduce  the  capability 
and  will  of  the  insurgency,  support  the  growth  in  capacity  and  capability  of  the  Afghan  National 
Security  Forces  (ANSF),  and  facilitate  improvements  in  governance  and  socio-economic 
development  in  order  to  provide  a  secure  environment  for  sustainable  stability  that  is  observable 
to  the  population.  Personnel  affiliated  with  US,  ISAF,  or  NATO  security  forces,  including 
interpreters  and  civilian  contractors,  are  "blue."  All  attacks  in  Afghanistan  in  which  a  person 
purporting  to  be  affiliated  with  the  Afghan  security  forces,  Afghan  National  Anny,  Afghan  Local 
Police,  Afghan  Border  Police,  Afghan  Uniformed  Police,  Afghan  Air  Force,  other  branches,  or 
security  personnel  hired  by  Afghan  authorities,  are  "green." 


Table  1  Total  KIA  per  month  and  year  and  total  Green/Blue  KIA  per  year  and  percentage 


Total  Deaths  Per  Month 

Year 

Total 

ISAF 

Total 

Afghan 

Security 

Forces 

Jan 

Feb 

Mar 

Apr 

May 

Jun 

Jul 

Aug 

Sep 

Oct 

Nov 

Dec 

Total 

Due  to 

Green 

on 

Blue 

%  due  to 

G/B 

2007 

41,741 

125,000 

2 

16 

8 

20 

25 

24 

28 

34 

24 

14 

22 

9 

232 

6 

2.57% 

2008 

51,356 

147,910 

14 

7 

19 

14 

22 

46 

30 

46 

37 

19 

12 

27 

295 

2 

0.68% 

2009 

84,146 

195,089 

24 

25 

28 

14 

27 

37 

75 

76 

67 

74 

28 

35 

521 

12 

2.30% 

2010 

130,930 

266,389 

43 

53 

37 

33 

51 

103 

88 

79 

57 

65 

58 

41 

711 

16 

2.25% 

2011 

131,  933 

323,410 

31 

36 

37 

51 

56 

66 

53 

81 

53 

42 

27 

27 

566 

39 

7.24% 

2012 

102,052 

337,187 

35 

18 

39 

39 

44 

39 

46 

52 

27 

23 

17 

14 

402 

66 

16.67% 

2013 

102,052 

343,362 

8 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

8 

3 

12.50% 

Deaths 

Per 

Month 

157 

155 

168 

171 

225 

315 

320 

368 

265 

237 

164 

153 

2735 

144 

5.23% 

Source:  Green-on-blue  attacks  in  Afghanistan:  the  data  -  The  Long  War  Journal.  The  Long  War 
Journal.  Retrieved  March  27,  2013. 


The  month  of  August  2012  had  the  largest  increase  of  attacks,  1 1  attacks  across  five 

provinces  killed  15  coalition  members.  Other  surges  of  green-on-blue  incidents  were  in  April 

2011  and  March  2012.  The  underlining  cause  to  the  rise  of  green-on-blue  attacks  in  2012  has  not 
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been  determined  and  will  be  impossible  to  detennine  given  that  the  assailant  has  died  during  the 
attack.  Seventeen  attacks  in  2012  occurred  within  48  hours  of  a  pervious  attack;  however,  there 
is  no  hard  evidence  to  conclude  that  these  subsequent  attacks  were  inspired  by  a  previous 

14 

event. 

ANSF  Recruitment 

In  2009,  Afghanistan’s  Defense  Ministry,  with  assistance  from  NATO,  launched  a 
recruiting  effort  to  double  the  size  of  the  ANSF.  Between  2009  and  2012,  the  ANSF  grew  from 
about  195,000  to  over  343,000  members.  Due  to  a  lack  of  volunteers,  Afghan  Army  recruiters 
promised  generous  compensation  to  young,  desperate,  and  jobless  Afghans,  who  often  gathered 
in  town  roundabouts  in  search  of  work.  The  Taliban  also  targeted  these  same  young  Afghans  for 
recruitment  as  Taliban  infiltrators  and  promised  them  the  opportunity  to  become  martyrs  by 
killing  infidels  in  their  land.  In  order  to  mitigate  attacks  within  the  ANSF  embedded  Afghan 
intelligence  agents  to  watch  for  any  ANA  soldier  or  ANP  officer  who  may  be  inclined  to  commit 
an  attack.  Government  agents  are  vetting  Afghan  recruits  carefully  in  the  hope  of  weeding  out 
Taliban  operatives  who  try  to  join  the  security  forces.  An  Afghan  colonel  points  out,  it  will  be 
impossible  to  do  an  adequate  job  of  vetting  the  tens  of  thousands  of  recruits  needed  if  the  Afghan 
military  and  police  are  to  reach  their  target  strength  of  350,000  by  2013.  He  stated  the  Afghan 
government  does  not,  “realistically  have  the  time  to  study  the  case  of  each  applicant,”  he  says. 
“We  look  them  over,  have  short  interviews,  and  make  background  checks.  But  who  knows  what 
is  really  in  the  young  man’s  heart  and  soul?”15  The  Taliban  has  successfully  infiltrated  the 
ANA,  ANP,  and  other  Afghan  security  forces  through  faulty  recruitment.  What  is  currently 
unknown  is  the  actual  extent  of  infiltration,  the  Taliban  inflate  their  perception  of  presence 
within  the  ANSF.  This  achieves  several  objectives  to  erode  trust  between  the  ISAF  and  the 
ANSF  in  the  eyes  of  international  community  and  local  population,  demoralize  the  ANSF  and 
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Afghan  population,  and  as  a  propaganda  victory  in  the  local  and  international  media  outlets. 

Both  the  Government  of  Afghanistan  and  NATO  believe  that  the  infiltration  is  overstated, 
although  infonnation  suggests  the  problem  may  be  more  substantial  than  is  publicly  admitted  by 
the  pro-government  forces. 16 

Afghan  National  Security  Forces  (ANSF)  consists  of  178,501  Afghan  National  Army 
(ANA)  troops  and  148,536  Afghan  National  Police  (ANP)  officers.  The  Afghan  National  Police 
(ANP)  include  25,000  border  police,  12,000  civil  order  police  (ANCOP),  and  2,200  special 
forces. 17  The  annual  attrition  rate  is  27%  for  ANA  and  15%  for  ANP. 18  Attrition  and  retention 
continues  to  be  a  challenge  due  to  poor  leadership  and  accountability,  separation  from  family, 
denial  of  leave  or  poor  leave  management,  high  operational  tempo,  and  ineffective  deterrence 
against  soldiers  going  absent  without  leave. 19  Consistently  high  attrition  negatively  affects 
ANSF  capabilities,  resulting  in  a  force  composed  of  many  inexperienced  soldiers.  Over  1,800 
women  serve  in  the  ANSF  and  women  represent  approximately  3%  of  new  recruits.  There  has 
only  been  one  green-on-blue  attack  committed  by  female  member  of  the  Afghan  National  Police. 
ANSF  have  taken  a  progressively  more  vital  role  in  combat  operations  as  the  transition  shifts  to 
Afghan  security  force  lead.  Afghans  participate  in  nearly  90%  of  operations  with  the  coalition, 
and  lead  more  than  80%  of  conventional  and  Special  Forces  operations  with  coalition  advisors 
and  assistance."  The  ANSF  remains  reliant  on  ISAF  for  key  enabling  capabilities  and  will 
remain  so  until  the  ANSF  they  have  full  capability  to  act  independently.  Among  the  ANSF,  the 
members  of  the  ANA  account  for  54%  of  the  green-on-blue  attacks. 

Insider  attacks  are  also  affecting  the  Afghan  Local  Police  (ALP),  a  key  component  of  the 

2 1 

Afghan  government  and  coalition  strategy  to  secure  rural  areas  ahead  of  the  2012  transition." 

The  ALP  established  in  July  2010  to  fill  security  gaps  by  supporting  armed  locals  in  providing 
security  within  their  own  villages,  though  they  retain  no  police  power.  As  of  December  2012, 
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the  ALP  consisted  of  over  16,300  officers  in  46  districts  and  will  eventually  to  a  force  of  30,000 
nationally.  Since  its  establishment,  the  ALP  accounts  for  four  separate  green-on-blue  attacks 
resulting  in  five  KIA  and  five  WIA. 


Number  of  K1A  and  Attacks  per  month  between  2007-2013 


KIA  PER  MONTH  2007-2013 

Jan 

Feb 

Mar 

Apr 

May 

Jun 

Jul 

Aug 

Sep 

Oct 

Nov 

Dec 

T  otal 

ALP 

0 

0 

1 

0 

0 

0 

0 

2 

2 

0 

0 

0 

5 

ANA 

9 

5 

7 

20 

4 

0 

10 

6 

2 

6 

3 

3 

75 

ANP 

0 

5 

0 

0 

3 

1 

3 

1 1 

8 

6 

5 

1 

43 

Other 

0 

0 

2 

2 

2 

0 

3 

0 

0 

6 

6 

0 

21 

9 

10 

10 

22 

9 

1 

16 

19 

12 

18 

14 

4 

144 

ATTACKS  PER  MONTH  2007-2013 


ALP 

0 

0 

2 

0 

0 

0 

0 

2 

1 

0 

0 

0 

5 

ANA 

6 

2 

4 

6 

3 

0 

6 

5 

2 

2 

3 

2 

41 

ANP 

1 

2 

0 

1 

2 

1 

1 

6 

3 

4 

1 

1 

23 

Other 

0 

0 

2 

1 

1 

0 

1 

0 

0 

1 

1 

0 

7 

7 

4 

8 

8 

6 

1 

'  8 

13 

6 

'  7 

'  5 

'  3 

76 

Source:  Green-on-blue  attacks  in  Afghanistan:  the  data  -  The  Long  War  Journal.  The  Long  War 
Journal.  Retrieved  March  27,  2013. 


Assuming  the  sample  is  representative,  the  majority  of  attackers  are  Pashtun,  the  Afghan  ethnic 
group  closely  aligned  with  the  Taliban  insurgency.  The  representation  of  Pashtuns  from  Taliban- 
dominated  provinces  in  the  south  and  east  is  about  three  per  cent  of  the  ANSF.  The  success  of 
green-on-blue  incidents  is  likely  to  inhibit  further  recruitment  from  these  areas,  exacerbating  the 
ethnic  disparity  in  the  ANSF.  Pentagon  officials  have  infonnation  on  the  ethnicity  of  the 
attackers  in  only  17  of  the  76  incidents  reported  since  2007;  12  attackers  were  Pashtun,  two  were 
Tajik,  two  were  Uzbek  and  one  was  Hazara.  ~  Attacker  identity  is  difficult  to  verify,  as  there  is 
limited  reported  data  to  support  proper  identification.  The  growing  number  of  incidents  has  the 
potential  to  create  turmoil  in  the  village  of  the  attacker  since  it  requires  two  notables  from  the 
village  to  certify  the  bona  fides  of  each  potential  recruit,  this  may  led  to  the  whole  village 
coming  under  suspicion  after  an  attack.  The  Pashtun  representation  in  the  Taliban  dominated 
provinces  in  the  south  and  east  regions  are  about  three  per  cent  of  the  ANSF.  Continued  attacks 
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are  likely  to  hinder  further  the  recruitment  from  these  areas,  exacerbating  the  ethnic  imbalance  in 
the  ANSF. 


Afghan  National  Army  and  Afghan  National  Police  Ethnicity 


Pashtun 

Tajik 

Hazara 

Uzbek 

Other 

ANA 

ANP 

ANA 

ANP 

ANA 

ANP 

ANA 

ANP 

ANA 

ANP 

Officer 

43.1% 

40.0% 

39.5% 

49.0% 

7.4% 

5.0% 

4.3% 

3.0% 

5.8% 

3.0% 

NCO 

49.6% 

32.0% 

41.3% 

55.0% 

5.6% 

5.0% 

2.0% 

4.0% 

1.4% 

4.0% 

Soldier/Patrolman 

42.6% 

47.0% 

30.9% 

35.0% 

11.7% 

4.0% 

8.2% 

7.0% 

6.6% 

7.0% 

Total  Force 

44.8% 

42.0% 

35.2% 

42.0% 

9.3% 

5.0% 

5.8% 

6.0% 

4.9% 

6.0% 

National  Avg 

44% 

25% 

10% 

8% 

13% 

ANA  numbers  as  of  September  2012,  ANP  as  of  December  201 1. 

Source:  Livingston  S.  Ian  and  O’FIanlon,  Micheal  Brookings  Afghanistan  Index,  February  28, 
2013. 


The  entire  ANSF  force-building  effort  is  under  stress  and  forced  to  recruit  lower-quality 
personnel,  men  with  less-known  backgrounds,  men  motivated  only  be  the  desire  for  employment 
and  money,  and  men  from  areas  where  their  culture  is  more  traditional  and  less  adaptable  to 
encounters  with  U.S.  and  ISAF  personnel.  The  original  intent  of  U.S.  and  Afghan  planners 
was  for  each  Kandak  of  the  Afghan  Army  to  have  officers  and  men  recruited  in  proportion  to  the 
ethnic  groups  of  the  land.  Desertions  presented  a  problem  for  the  start  when  establishing  the 
ANA  Kandaks,  so  the  Pashtun  became  the  majority-minority.  The  rapid  expansion  of  the  ANSF 
with  less  than  qualified  recruits,  has  added  pressure  and  created  tension,  as  do  constant  U.S.  and 
ISAF  withdrawals,  rotations  of  personnel  and  trainers,  base  closings  and  realignments.  Coupled 
with  problems  in  providing  ANSF  forces  with  adequate  leave  and  recovery  time,  all  of  these 

24 

interact  to  create  sources  of  turbulence  within  the  ANSF. 

Understanding  the  underlying  motivation  behind  a  green-on-blue  attack  is  difficult  to 
determine  and  asses  due  to  the  reliability  of  incident  reporting,  what  events  are  reported  as  a 
green-on-blue  attack,  and  the  attacker  is  often  killed.  General  Joseph  F.  Dunford  Jr.,  commander 
of  the  International  Security  Assistance  Force  and  U.S.  Forces  Afghanistan  (USFOR-A), 
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identified  several  factors  attributing  to  rise  in  green-on-blue  attacks  as  insurgent  infiltration, 
impersonation,  co-option  as  a  means  to  commit  an  insider  attack,  inter-personal  disputes  and  as  a 
means  to  foment  extremist  views  through  propaganda  and  messaging.  The  Inside  the  Wire 
Threats  handbook  quotes  Dr.  Bordin’s  report  as  to  factors  that  fueled  the  most  animosity 
included  convoys  not  allowing  traffic  to  pass,  reportedly  indiscriminant  return  of  direct  and 
indirect  fires  that  caused  civilian  casualties  (CIVCAS),  use  of  flawed  intelligence,  ISAF/CF 
conducting  night  raids/home  searches,  violating  female  privacy  during  searches,  road  blocks, 
publicly  searching/disarming  ANSF  members  as  a  standing  operating  procedure  (SOP)  when 
they  enter  bases,  and  past  massacres  of  civilians  by  ISAF/CF  (i.e.,  the  Wedding  Party  Massacre, 
the  Shinwar  Massacre,  etc.).  Green-on-blue  attacks  are  a  troubling  development  that  can  pose 
serious  implications  for  the  transfer  of  security  to  the  ANSF. 

In  May  2011,  Dr.  Jeffrey  Bordin,  a  behavioral  scientist  under  US  Army  contract,  issued  a 
report  warning  that  green-on-blue  or  insider  attacks  were  not  only  a  systemic  problem,  but  also 
that  the  problem  would  get  worse  unless  the  International  Security  Assistance  Force  took 
measures  to  address  the  problem.  Dr.  Borodin’s  report  contained  recommendations,  from  the 
treatment  of  Afghan  civilians  during  combat  operations  to  understanding  of  cultural  relations 
between  ISAF  and  ANSF.  Dr.  Bordin  concluded  his  report  by  stating,  "The  research  completed 
here  shows  that  there  is  a  great  deal  of  deep  seated  anger,  distrust  and  cultural  incompatibility 
between  US  and  ANSF  personnel  that  is  precluding  further  development  of  the  ANSF  as  well  as 
greatly  endangering  the  lives  of  US  and  other  ISAF  soldiers,".-  Portions  of  Dr.  Bordin’s  report 
are  in  the  Center  for  Army  Lessons  Learned  (CALL)  handbook  titled  Inside  the  Wire  Threats  - 
Afghanistan  Green-on-blue,  Observations,  Insights,  and  Lessons.  The  handbook  is  a  training  aid 
used  for  operational  and  institutional  purposes  that  contribute  to  the  overall  success  of  United 

9Q 

States,  coalition,  and  allied  efforts. 
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Dr.  Bordin’s  May  2011  report  titled,  "A  Crisis  of  Trust  and  Cultural  Incompatibility",  he 
conducted  over  600  interviews  with  ANSF  personnel,  his  findings  warned  of  an  increasing  threat 
from  ANSF  to  ISAF  personnel,  based  on  his  conclusions  of  cultural  incompatibility.  In  his 
report,  he  presented  numerous  recommendations  for  educating  and  improving  cultural  awareness 
between  forces.  The  report  originally  released  as  “unclassified”,  but  later  classified  as  "secret" 
by  military  officials  from  the  U.S.  Central  Command  in  Florida  at  the  request  of  coalition 
officials  in  Afghanistan.  Government  personnel  dismissed  his  report  and  Dr.  Bordin  was 
eventually  relieved  of  his  duties  as  Red  Team  research  leader.  Coalition  officials  disputed  the 
report's  conclusions.  "The  findings  are  not  consistent  with  our  assessment"  of  Afghan  forces, 
said  coalition  spokeswoman  LCDR  Colette  Murphy.  The  study,  she  added,  "was  systematically 
flawed,  and  suffered  from  generalizations,  narrow  sample  sets,  unprofessional  rhetoric,  and 

ii 

sensationalism."  The  military  is  now  listening,  touting  new  programs  to  promote  cultural 
understanding  among  Western  troops  and  using  Bordin’s  report  to  come  up  with  solutions  to  a 
crisis  that  is  undermining  the  very  foundations  of  the  coalition  effort  to  transition  the  country  to 

T9 

Afghan  control. 

The  report  warns  that  “unfortunately,  the  rapidly  growing  fratricide-murder  trend 
committed  by  ANSF  personnel  against  ISAF  members  is  a  valid  COIN  [counterinsurgency] 
measure  of  the  ineffectiveness  in  our  efforts  in  stabilizing  Afghanistan;  developing  a  legitimate 
and  effective  government;  battling  the  insurgency;  gaining  the  loyalty,  respect  and  friendship  of 
the  Afghans;  building  the  ANSFs  into  legitimate  and  functional  organizations;  and  it  also 

33 

challenges  the  efficacy  of  the  ‘partnering’  concept." 

The  study  concludes  that  although  “assumptions  and  official  pronouncements  that  the 
continuing  pattern  of  fratricide  murders  by  ANSF  personnel  are  'isolated'  and  largely  being 
committed  by  insurgent  infiltrators,  the  research  shows  that  there  is  a  great  deal  of  deep  seated 
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anger,  distrust  and  cultural  incompatibility  between  U.S.  and  ANSF  personnel  that  is  precluding 
further  development  of  the  ANSF  as  well  as  greatly  endangering  the  lives  of  U.S.  and  other  ISAF 
soldiers.”34 

Dr.  Bordin’s  study  appears  to  support  his  thesis  that  well-planned  infiltration  is  less 
common  than  spontaneous  fratricide.  The  international  forces'  emphasis  on  “quantity  over 
quality  with  regard  to  the  ANSF’s  buildup  has  been  self-destructive”  because  ISAF  soldiers 
“have  to  train  Afghans  who  are  illiterate,  unmotivated  (with  an  annual  attrition  rate  of  25% 
mostly  due  to  desertion),  often  drug-addicted,  who  very  often  come  from  the  least  desired 
segments  of  Afghan  society,  and  are  somewhat  prone  to  turning  on  and  murdering  their  Western 
trainers."35 

The  assumption  is  that  green-on-blue  attacks  against  ISAF  personnel  is  a  threat,  which 
the  ISAF  must  mitigate,  as  green-on-blue  attacks  are  "isolated"  and  "extremely  rare."  In  a  brief 
to  reporters  at  the  Pentagon,  U.S.  Marine  Gen.  John  Allen  was  asked  how  he  accounted  for  the 
recent  increase  in  so-called  “green-on-blue”  attacks,  and  replied  that  it  “may  have  something  to 
do  with  Ramazan.”  “And  so  the  daily  pressures  that  are  on  some  of  these  [Afghan]  troops, 
compounded  by  the  sacrifice  associated  with  fasting,  the  nature  of  our  operational  tempo  - 
remembering  that  Afghan  troops  have  gone  to  the  field  and  they  have  stayed  in  the  field,  and 
they’ve  been  in  combat  now  for  years  -  we  believe  that  the  combination  of  many  of  these 
particular  factors  may  have  come  together  during  the  last  several  weeks  to  generate  the  larger 

36 

numbers  [of  insider  attacks]  that  you  point  to.” 

ANSF  member  regard  the  use  of  profanity  U.S.  personnel  disrespectful.  An  Afghan 
Major  said,  “Americans  use  the  word  f— k  all  the  time.”  Many  Afghan  troops  take  the  meaning 
sexually,  not  as  a  meaningless  expletive,  the  understanding  is  lost  in  translation.  The  Major 
explained  of  an  incident  during  a  joint  patrol  where  a  U.S.  soldier  who  saw  some  Afghan  women 
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carrying  heavy  loads  of  firewood  on  their  heads  and  who  remarked:  “Those  f— king  Afghan 
women  really  work  hard.”  The  next  day  I  heard  a  number  of  complaints  from  my  men  saying 
that  these  U.S.  soldiers  are  lusting  after  our  women  and  abusing  our  culture.”  The  major  said 
his  soldiers  hate  when  U.S.  troopers  urinate  on  rural  trails  used  by  village  women  or  when  they 
stare  at  local  women. 

Afghanistan’s  top  military  commander  said  his  officers  also  shared  blame  for  the  so- 
called  insider  attacks  for  not  giving  their  men  a  better  understanding  of  why  they  should  fight 
against  the  Taliban  alongside  their  Western  allies.  Gen.  Sher  Mohammad  Karimi,  the  Afghan 
National  Anny’s  chief  of  staff,  said  “We  neglect,  we  ignore,  we  do  not  know  our  soldiers.  We  do 
not  communicate  with  them.  We  do  not  advise  and  instruct  them,.”  and  “They  don’t  know  why 
we  are  fighting.”  The  Defense  Ministry  has  no  numbers  or  a  breakdown  of  the  Afghan  troops 
held  as  suspected  traitors  vs.  those  dismissed  for  insufficient  documentation  and  proof  of  loyalty. 
He  did  not  specify  if  any  Afghan  troops  received  any  disciplinary  action.  “Hundreds  were 
sacked  or  detained  after  showing  links  with  insurgents,”  ministry  spokesperson  Zahir  Azimi  said 
at  a  news  conference.  “In  some  cases,  we  had  evidence  against  them;  in  others,  we  were  simply 
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suspicious. 

The  ISAF  Insider  Threat  Mitigation  Team,  break  the  motives  into  three  main  categories. 
First,  approximately  20%  are  due  to  insurgent  involvement,  to  include  infiltration,  influence, 
cooption,  or  impersonation.40  Infiltration  in  which  an  insurgent  member  joins  the  ANSF  through 
recruitment  process  then  supports  the  insurgency  by  collecting  intelligence,  committing  sabotage 
or  an  attack.  Cooption  recruits  a  member  of  the  ANSF  through  ideological  pressures,  monetary 
incentives,  intimidation,  extortion,  or  family  or  tribal  affiliation,  to  commit  or  assist  in  attacks  on 
behalf  of  the  insurgency.  Impersonation  the  attacker  poses  as  an  ANSF  member  in  order  to 
conduct  an  attack  against  ISAF  personnel.  The  attackers  obtain  ISAF  uniforms  and 
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identification  cards  through  cooption  or  purchased  at  local  bazaar  and  may  receive  support 
ANSF  personnel  who  have  access  to  base  facilities  or  information  to  support  the  attacker. 
Second,  40%  of  the  attacks  are  the  result  of  inter-personal  disputes  and  extremist  views  between 
an  ISAF  and  ANSF  member  who  acts  as  an  independent  perpetrator  without  outside  influence  or 
command  from  external  agencies.  41  Third,  the  motive  for  about  40%  of  attacks  is  unknown 
because  the  attacker  is  killed  or  escapes. 42 


Region 

G/B  KIA 

G/B 

Attacks 

Total  AOG 

Initiated 

Attacks 

2010- 

2012 

Capital 

16 

6 

350 

East 

38 

18 

12426 

North 

9 

5 

1877 

South 

32 

20 

5864 

Southwest 

35 

20 

4639 

West 

14 

9 

2984 

144 

78 

28140 

AOG-  Armed  Opposition  Groups  Taliban,  Haqqani  Network, 

and  Hezb-i-Islami  Source:  www.ngosafety.org/reports.html,  Quarterly  Data  Report  Q  4  2012 

Insider  attacks  were  largely  concentrated  in  the  Southern,  Southwestern,  and  Eastern 
regional  commands.  These  are  provinces  where  ISAF  troop  concentration  is  high,  Taliban 
presence  is  at  its  strongest,  and  where  the  highest  levels  of  opium  poppy  production  in  the 
country.  More  than  half  of  all  attacks  in  2012  occurred  in  Kandahar  and  Helmand,  which  were 
the  focus  of  the  counterinsurgency  campaign  during  the  "Surge.”  Areas  where  attacks  have 
occurred  are  broken  down  into  three  categories:  1)  Military  controlled  ISAF  bases  40  attacks 
(54.8%),  patrols,  raids,  and  other  operations  in  the  field  19  attacks  (26%),  and  Police 
station/checkpoint  under  Afghan  control  14  attacks  (19. 2%). 43  Attacking  military  controlled 
ISAF  bases  is  a  successful  tactic  for  the  insurgency  because  it  has  the  potentially  to  effect  both 
the  domestic  and  the  international  community’s  willingness  to  stay  involved  in  the  campaign. 
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ANSF  casualties  reduce  the  number  of  volunteers  and  demoralize  new  recruits,  with  every  ISAF 
casualty  the  coalition  casualty  aversion  increases. 

The  Taliban,  Hezb-i-Islami  Gulbuddin  (HIG),  and  the  Haqqani  network  groups  fighting 
in  Afghanistan  have  adopted  the  same  green-on-blue  tactics  for  similar  purposes  of  eroding  trust 
and  questioning  the  security  efforts  provided  by  the  ANSF.  The  Taliban  and  HIG  have  the 
deepest  penetration  into  the  Government  of  Afghanistan  structure,  while  the  Taliban  has  the  most 
extensive  network  within  Afghan  security  forces.44  The  Haqqani  network  may  be  the  most 
dangerous  insurgent  group,  due  to  its  organization,  training,  and  equipped  members.  The 
Haqqani  network  has  now  managed  to  infiltrate  into  the  ANSF  and  the  Government  of 
Afghanistan.45 

A  Taliban  statement  by  Mullah  Omar  included  33  specific  points  regarding  the 
infiltration  of  Taliban  members  into  Afghan  security  forces.  He  stated  that  this  would  allow 
them  to  gain  entrance  to  secure  bases  where  they  would  be  able  to  “easily  carry  out  decisive  and 
coordinated  attacks,  inflicting  heavy  losses  on  the  enemy  both  in  life  and  equipment.”46  Omar 
also  invited  members  of  the  military  and  police  to  stop  their  support  of  the  coalition  invaders  and 
“join  the  ranks  of  the  Mujahedeen  like  your  heroic  colleagues.”  47  Attacks  aboard  military 
installations  have  the  most  affect  both  politically  and  as  a  source  insurgent  propaganda. 

In  2012,  the  Taliban  solicited  a  member  of  the  ANP  by  offering  him  2.5  million  Afghani 
($50,000  U.S.)  for  assistance  in  committing  an  attack  against  ISAF  members.  The  ANP  Officer 
informed  his  commander  who  allowed  him  to  continue  to  meet  with  the  insurgents  to  gain 
intelligence.  This  led  to  the  arrests  of  six  suicide  bombers,  of  which  three  were  junior  police 
recruits  with  issued  uniforms.  The  operation  provided  ISAF  and  Afghan  commanders  invaluable 
information  regarding  how  the  Taliban  recruits  and  handles  operatives  within  Afghan 

48 

government  organizations  leading  up  to  an  attack. 
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Country 

G/B  KIA 

Total 

KIA 

Green  i 

Blue  ! 

United  States 

77 

1819 

4.12% 

Spanish 

2 

15 

13.33% 

Australian 

7 

38 

18.42% 

United  Kingdom 

22 

396 

5.30% 

Albanian  Army 

1 

1 

100.00% 

Italian 

1 

38 

2.63% 

Germany 

3 

33 

9.09% 

French 

7 

75 

9.33% 

US  Civil/Con tractc 

8 

55 

14.55% 

State  Department 

1 

Unkown  data 

Translator 

3 

Unkown  data 

Afghan 

12 

Unkown  data 

Total 

144 

Source:  Green-on-blue  attacks  in  Afghanistan: 
the  data  -  The  Long  War  Journal.  The  Long 

War  Journal.  Retrieved  March  27,  2013. 

Coalition  Response 

Creating  an  Afghan  force  needed  to  bring  security  and  stability  has  proven  to  be  far  more 
difficult  challenge  than  many  realize,  and  poses  major  challenges  that  will  endure  long  after  U.S. 
forces  depart.  The  effort  to  train  Afghan  forces  that  can  replace  the  role  of  U.S.  and  allied 
forces,  must  overcome  a  legacy  of  more  than  eight  years  of  critical  failures  in  both  force 
development  and  training.  These  attacks  have  triggered  a  loss  in  confidence  and  trust  amongst 
the  ISAF  and  civilians  with  ANSF  personnel,  ultimately  effecting  ANSF  training  and  operations. 
The  political  impact  associated  with  green-on-blue  attacks  is  very  significant.  The  Taliban  and 
insurgents  are  fighting  a  political  war  to  influence  and  dominate  the  Afghan  people  and  to  drive 
out  U.S.  and  other  ISAF  forces,  as  well  as  aid  efforts.49  The  insurgents  know  that  the  actual 
numbers  involved  are  not  the  issue;  what  counts  are  the  political  impacts  and  the  effect  it  has  to 
influence  media  coverage  of  the  war.  This  changes  the  U.S.  Congress,  the  American  public,  and 
the  attitudes  of  other  ISAF  and  donor  countries  to  support  the  war  effort.  High  profile  Taliban 
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and  insurgent  attacks  on  Afghan  officials  or  other  major  targets  in  Afghanistan,  and  the 
pervasive  insurgent  effort  to  infiltrate  and  influence  the  Afghan  populace,  are  having  a  major 
impact  on  overall  support  for  the  war  in  what  is  now  a  war  of  political  attrition. 

As  green-on-blue  attacks  rise  public  support  for  the  ISAF  mission  drops  with  many  of  the 
troop-contributing  nations,  even  if  the  connection  between  Afghanistan  and  terrorism  is  widely 
understood  and  the  Taliban  remain  unacceptable  to  citizens  of  democracies.  The  public  see  its 
military  forces  continue  to  take  casualties  in  a  long  and  expensive  operation  to  boost  security  in  a 
faraway  country,  while  public  spending  is  being  cut  at  home  in  many  countries.  Philip 
Hammond,  British  Secretary  of  State  for  Defence,  stated,  “ISAF  recognizes  that  the  incidents  of 
insider  attacks  are  sapping  public  opinion,  public  morale,  in  the  ISAF  home  countries”.  Political 
leaders  of  troop  contributing  nations  must  strongly  and  regularly,  make  their  case  to  citizens,  that 
the  mission  in  Afghanistan  remains  necessary.50  Though  ISAF  and  ANSF  are  winning  tactically, 
the  threat  of  a  green-on-blue  attack,  has  given  the  insurgents  some  momentum  to  a  political  war 
of  transition.  The  threat  of  a  green-on-blue  as  a  valid  concern  by  troop  contributing  to  the 
countries,  both  ISAF  and  the  ANSF  must  coordinate  to  undermine  factors  leading  to  the  rise  to 
these  attacks. 

In  response  to  green-on-blue  attacks,  the  French  government  in  December  2011  and 
January  2012  threaten  withdraw  troops.  French  President  Nicolas  Sarkozy  suspended  French 
military  operations  in  Afghanistan  and  said  that  such  attacks  would  trigger  acceleration  in  the 
French  withdrawal  from  Afghanistan.  51  French  Defense  Minister  Gerard  Longuet  said  the  troops 
that  were  killed  and  wounded  in  these  two  incidents  were  victims  of  trust,  as  they  considered  the 
Afghan  soldiers  to  be  their  comrades.  France  and  other  troop  contributing  countries  stressed 
that  their  concerns  are  valid  and  ISAF  and  NATO  officials  along  with  Afghan  government  must 
manage  the  causes  leading  to  these  attacks. 
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The  Taliban  thrives  on  the  propaganda  of  green-on-blue  attacks,  as  a  tool  to  demonstrate 
its  capacity  to  inflict  damage  on  the  ISAF  and  Afghan  forces.  The  Taliban  have  utilized  green- 
on-blue  attacks  in  their  propaganda:  Mullah  Omar,  leader  of  the  Taliban  faction  known  as  the 
Quetta  Shura,  claimed  the  Taliban  had  "cleverly  infiltrated  in  the  ranks  of  the  enemy"  and 
encouraged  Afghan  government  officials  and  security  personnel  to  defect  to  the  Taliban  as  a 
matter  of  religious  obligation  and  “join  the  ranks  of  the  Mujahedeen  like  your  heroic 
colleagues.”/  By  inciting  higher  levels  of  violent  protests  and  depicting  a  weaker  U.S.  position 
in  Afghanistan,  they  seek  to  find  a  place  at  the  negotiating  table  and  in  future  power  sharing 
arrangement.^4  The  Taliban  claim  responsibility  to  all  green-on-blue  attacks,  in  order  to 
exaggerate  its  effects  on  ISAF  troops  and  fuel  it  propaganda  message.  Taliban,  representative 
said  it  had  "forced"  NATO  commanders  into  the  decision  by  sowing  distrust  among  Afghan  and 
foreign  troops.  "This  is  the  result  of  the  mujahideen's  operations  and  tactics  that  forced  the 
enemy  to  abandon  their  plans,"  Zabihullah  Mujahed  said.  "This  is  an  achievement  for  the 
mujahideen  who  have  managed  to  create  mistrust  among  the  enemy  forces  and,  God  willing,  this 
is  the  start  of  their  overall  defeat  in  Afghanistan,"  said  Taliban  spokesman  Zabihullah 
Mujahed.55 

Understanding  the  cultural  aspect  of  the  threat 

The  Pentagon  states  the  majority  of  green-on-blue  attacks  are  a  result  of  cultural 
grievances.  56  They  occur  because  of  cultural  misunderstandings  between  ISAF  and  Afghan 
troops,  possible  revenge  for  perceived  insults  or  provocations.  Cultural  misunderstandings  and 
mistranslations  on  both  sides  can  damage  and  form  resentment  between  ANSF  and  ISAF 
members.  Issues  related  to  honor  and  dignity,  insults,  profanity  and  vulgarity  to  ANSF 
members,  publicly  searching  and  disanning  ANSF  members  when  they  enter  Coalition  military 
bases.  Cultural  issues  such  as  indecent  exposure  while  urinating  in  public  or  urinating  in  streams 
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of  water,  arrogance,  violating  female  privacy  during  searches,  searching  them  and  taking  their 
photographs. 

National  incidents  that  have  cause  outrage  among  the  Afghan  population  include  the 
burnt  copies  of  the  Quran  in  a  garbage  dump  at  Bagram  Air  Base  that  sparked  several  days  of 
anti-American  riots  in  February  2012.  An  Afghan  soldier  shot  and  killed  two  U.S.  Army 
Soldiers  at  an  outpost  in  eastern  Afghanistan’s  Nangarhar  Province  and  then,  fled  into  the  large 
crowd  of  demonstrators  outside  the  base.57  An  U.S.  Army  Sergeant  killed  16  women,  children, 
and  men  as  they  slept  and  then  attempted  to  burn  their  corpses  in  March  2012.  In  addition,  the 
video  of  U.S.  Marines  urinating  on  the  corpses  of  dead  Taliban  fighters  and  the  photos  of  U.S. 
posing  with  body  parts  taken  from  dead  insurgents.  It  made  no  difference  that  the  bodies  were 
insurgent  fighters  in  Afghanistan;  you  do  not  desecrate  the  dead.  In  2012 —  almost  once  every 
two  weeks  — Afghan  soldiers,  policemen,  or  security  guards,  largely  in  units  being  trained  or 
mentored  by  the  US  or  its  NATO  allies,  have  turned  their  guns  on  those  mentors,  the  people  who 
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are  funding,  supporting,  and  teaching  them,  and  pulled  the  trigger. 

Coalition  steps  to  mitigate  green-on-blue 

Senior  ISAF  and  Afghan  commanders  and  government  officials  attended  conferences  in 
August  and  September  2012  to  discuss  the  rise  of  green-on-blue  attacks  and  an  effective  means 
to  counter  the  ongoing  threat.  The  ISAF  developed  a  program  of  tasks  and  a  variety  of 
countermeasures  to  mitigate  green-on-blue  threats.  They  also  created  two  Insider  Treat  Action 
Groups  (ITAG)  comprised  of  ISAF  and  ANSF  personnel,  to  manage  and  oversee  established 
programs,  one  headed  by  a  three-star  and  the  other  by  a  one-star.  The  one-star  level  joint  board 
is  further  tasked  to  ensuring  policies  set  by  the  ITAG  are  properly  implemented.  Also 
established,  an  Insider  Threat  Mitigation  Team,  an  executive  oversight  group  of  senior  Afghan 
and  Coalition  leaders,  tasked  with  monitoring,  directing,  and  initiating  the  new  threat  mitigation 
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initiatives.  A  joint  assessment  commission  will  study  incidents  and  identify  lessons  and  required 
actions  for  the  future.  59 

General  Karimi,  directed  the  Religious  and  Cultural  Affairs  (RCA)  Department  of  the 
ANA  to  develop  and  train  all  Afghan  Soldiers  on  the  cultural  practices  of  their  ISAF  partners  to 
mitigate  further  attacks.  RCA  developed  a  training  program  and  package,  which  included  a 
twenty-eight  page  booklet  with  guided  discussion  questions  titled  “A  Brochure  for 
Comprehending  the  Cultures  of  the  Coalition  Forces,”  approved  by  General  Karimi.  He  directed 
that  all  ANA  soldiers  receive  the  training  and  incorporate  the  program  into  selected  courses  at 
the  various  Afghan  training  institutions.  The  training  booklet  identifies  the  supporting  ISAF 
nations  and  highlights  the  cultural  diversity  that  exists  among  them.  It  addresses  diversity  as  a 
source  of  ISAF  strength  and  compares  coalition  diversity  to  the  diversity  that  exists  within 
Afghanistan,  suggesting  that  each  of  the  various  Afghan  ethnic  groups  offers  something  essential 
to  the  strength  of  the  Afghan  nation  just  as  the  various  ISAF  nations  combine  to  form  a  strong 
coalition.  It  highlights  the  need  to  look  for  shared  values  or  common  interests  that  can  bring 
them  back  together  with  their  ISAF  partners  in  pursuit  of  victory.  The  RCA  implemented  the 
training  on  September  5,  2012. 60  There  are  no  reported  numbers  of  trained  ANSF  members  or  if 
any  have  committed  any  attacks. 

Preventive  Measures  against  Green-on-Blue  Attacks 

With  the  continued  presence  in  Afghanistan,  green-on-blue  attacks  will  remain  a  constant 
threat  to  ISAF  personnel  throughout  the  drawdown  and  transition  from  combat  role  to  assisting 
Afghan  forces  maintain  security.  Among  the  available  training  resources  that  identify  best 
practices  for  mitigating  the  insider  threat  is  a  recent  training  video,  prepared  jointly  by  the 
Asymmetric  Warfare  Group  (AWG),  the  Center  for  Army  Lessons  Learned  (CALL),  the 
Training  and  Doctrine  Command  (TRADOC)  Culture  Center,  and  the  TRADOC  Intelligence 
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Support  Activity  (TRISA),  entitled  Insider  Threats  in  Afghanistan.61  The  video  points  to  the 
majority  of  insider  attacks  attributed  to  personal  grievances  as  the  most  likely  cause,  although 
co-option  appears  to  be  an  escalating  threat.  The  video  highlights  four  real  attacks  in  2012  to 
serve  as  the  basis  for  discussion  for  on  best  practices  in  order  to  mitigate  insider  threat. 

In  addition,  the  CALL  published  the  Inside  the  Wire  Threats  -  Afghanistan  Green-on- 
blue  handbook  and  the  pocket  smartcard  entitled  Insider  Threats  in  Partnering  Environments,  A 
Guide  for  Military  Leaders.  The  AWG  identified  the  need  for  developing  an  insider  threat 
handbook  to  “help  educate  and  train  forces  on  the  behaviors,  beliefs,  customs,  norms,  and  values 
of  the  Afghan  people”.  ~  Together  these  assist  deploying  personnel  to  understand  when  to  act 
and  report  suspicious  insider  threats,  particularly  in  a  partnering  and  deployed  environment  like 
Afghanistan. 


Figure  2 

The  smartcard  splits  the  observable  indicators  into  three  categories,  as  seen  in  figure  1, 
depending  upon  when  action  is  required.  In  Category  I  Indicators,  an  individual  can  take  several 
actions  such  as  seeking  legal  consultation,  reporting  the  behavior  or  asking  the  suspect  for 
clarification  rather  than  observing  to  see  if  the  behavior  worsens  before  becoming  a  Category  I 
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or  III  behavior.  In  the  Category  II  or  III  Indicators,  the  observer  should  report  the  conduct  and 
take  immediate  action.  Immediate  actions  include  reporting  to  counter-intelligence  and  Chain  of 
Command.  The  Observable  Indicators  attempts  to  differentiate  between  the  high-risk  individual 
and  the  insider  threat  individual,  as  a  category  one  behavior  signifies  high-risk  behavior.  There 
are  seventeen  preventive  tools  troops  can  implement  to  deter  an  insider  threat,  prior  any  behavior 
reaching  a  Category  II  or  III  threat. 

A  concerted  effort  between  the  Afghan  government  and  military  and  the  Coalition  lead  to 
several  concrete  measures  to  defeat  the  insider  threat.  Among  the  new  initiatives  being 
implemented  are  improvements  to  the  vetting  process  for  new  recruits  (Fig);  increasing  the 
number  of  counterintelligence  teams;  introduction  of  interview  procedures  for  ANA  soldiers 
returning  from  leave;  a  new  warning  and  reporting  system  for  insider  threats;  enhanced 
intelligence  exchange  between  the  ANSF  and  ISAF;  establishment  of  an  anonymous  reporting 
system;  improved  training  for  counter-intelligence  agents;  establishment  of  a  joint  investigation 
commission  when  insider  threats  occur;  and  enhanced  cultural  training  to  include  visits  to 
Coalition  home  training  centers  by  Afghan  Cultural  and  Religious  Affairs  advisers,  which  were 

63 

authorized  by  President  Karzai. 

There  has  been  an  update  to  Insider  Threat  training  guidance  for  troop  contributing 
nations  across  three  tiers:  National  pre-deployment  training,  reception  training  upon  arrival  in¬ 
theater,  and  continuation  training  throughout  their  tour  in  Afghanistan.  The  content  of  this 
training  is  to  hone  training  objectives  based  upon  theater  procedures,  absorb  lessons  learned  from 
recent  green-on-blue  attacks,  accommodate  input  of  Afghan  Religious  and  Cultural  Affairs 
officers  for  course  content,  and  build  Afghan  counterintelligence  capacity  and  capability.64 

The  professionalism  and  reliability  of  the  nearly  350,000-plus  Afghan  security  forces 
members  is  essential  if  ISAF  is  to  have  any  success.  The  introduction  of  several  new  measures 
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to  deal  with  attacks:  is  adding  addition  counterintelligence  teams,  instituting  new  interview 
procedures  for  soldiers  returning  from  leave,  establishing  a  warning  system  for  insider  threats 
and  enhancing  cultural  training  for  Afghan  and  ISAF  personnel.  It  remains  unclear  how  or  if 
these  measures  will  effect  further  incidents  of  green-on-blue. 

Conclusion 

Members  of  ISAF's  Insider-Threat  Mitigation  Working  Group  said  Gen.  John  R.  Allen, 
ISAF  commander,  recognizes  insider  attacks  as  a  top  risk  and  has  leveraged  “brainpower”  and 
leadership  to  mitigate  the  threat  and  “ISAF  is  doing  everything  it  can  to  protect  coalition 
forces”.65  Incidents  like  the  bombing  of  mosques  and  madrassas,  desecration  of  the  Holy 
Qur’an,  indiscriminate  killing  by  the  U.S.  soldiers  during  night  raids,  and  urination  by  Marines 
on  the  bodies  of  dead  Taliban,  do  nothing  but  further  fuel  the  hatred  amongst  Afghan  populace 
and  Afghan  security  forces  against  the  foreign  forces. 

Infiltration  is  one  of  the  insurgents’  key  strategies  in  their  fight  against  the  ISAF.  The 
use  of  infiltrators  and  insiders  is  now  more  organized  and  systematic  than  in  previous  years,  and 
therefore  poses  a  significant  threat  to  NATO  exit  strategy.  In  2012,  the  rise  in  infiltration-related 
attacks  targeting  ISAF  members  has  become  more  frequent.  This  trend  is  predicted  to  continue 
until  ISAF  exit  Afghanistan. 

Review  of  threats  posed  to  ISAF  shows  green-on  blue  attacks  as  a  problem  and  is  on  the 
rise,  with  seeming  no  end.  A  surge  in  green-on-blue  attacks  is  certainly  has  far-reaching  effects 
insofar  as  NATO’s  strategy  and  strategic  ends  in  Afghanistan  are  concerned.  Under  current 
circumstances,  Afghan  security  forces  assuming  complete  security  responsibility  in  the  country 
beyond  2014  without  U.S.  support  seems  questionable.  If  they  do  it  with  some  American 
support,  common  Afghans  as  well  as  the  Taliban  would  question  their  legitimacy,  and  it  would 
remain  as  the  Taliban  versus  the  U.S.  conflict  in  the  main.66  The  ANSF  and  ISAF  members 
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must  implement  preventive  measures  to  address  infiltration  issues  just  as  it  is  vital  that  ISAF 
members  show  respect  for  the  cultural  norms  and  sensitivities  of  the  Afghan  population  and  the 
ANSF  members  they  are  working  with.  The  rapid  growth  of  the  ANSF  from  200,000  to  over 
350,000  in  just  two  years  suggest  that  more  attention  is  paid  to  numbers  than  to  the  quality  and 
size  of  these  forces.  The  doubling  of  the  ANSF  with  no  clear  vision  of  quality,  effectiveness, 
and  efficiency  of  forces  has  inevitably  led  to  compromises. 

As  incidents  or  the  threat  of  green-on-blue  attacks  increases  and  is  directed  against  the 
ISAF,  it  is  appropriate  to  continue  to  examine  the  motivations  of  the  attacker  in  order  to 
determine  the  insider  threat.  Lessons  learned  from  past  attacks  provide  material  for  indicators  in 
order  to  detect  and  recognize  the  possibility  of  an  attack  before  it  happens.  Green-on-blue 
attacks  originating  from  social  and  cultural  disputes  between  ISAF  and  ANSF  may  occur,  but  it 
has  now  moved  to  a  standard  Taliban  Tactic,  Techniques,  and  Procedure,  which  they  have 
proven  to  very  successful. 
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APPENDIX  A-  DATA  SUMMARY 


Data  covers  green-on-blue  attacks  in  Afghanistan  from  May  7,  2007  through  7  April  2013,  there 
have  been  a  total  of  78  attacks. 

Total  number  of  attacks  per  year: 

2013  -4  2012-44  2011  -  16  2010-5 

2009  -  5  2008  -  2  2007- 2 

Total  number  of  attacks  per  province: 

Badghis  -  4  Baghlan  -  1  Balkh  -  2  Farah  -  1 

Faryab  -  2  Helmand  -  19  Herat  -  2  Kabul  -  5 

Kandahar- 14  Kapisa-2  Kunar-1  Laghman-3 

Nangarhar  -  3  Paktia  -  2  Paktika  -  3  Uruzgan  -  4 

Wardak  -  3  Zabul  -  2 

The  total  number  of  Coalition  deaths  from  green-on-blue  attacks  for  the  period  May  7,  2007  to 
the  present  is  144.  The  total  number  of  Coalition  wounded  is  168. 

Green-on-blue  deaths  per  year,  and  percentage  of  Coalition  deaths  caused  by  such  attacks: 

2013-1-12.5%  2011  -39-7.2%  2009-  12-2.3%  2007-6-2.6% 

2012  -  66  -  16.7%  2010  -  16  -  2.3%  2008  -  2  -  less  than  1% 

Green-on-blue  wounded  per  year: 

2013  -  16  2011  -34  2009-  11 

2012-81  2010  -  1  2008  -3 

Total  number  of  green-on-blue  deaths  per  province: 

Badghis  -  5  Baghlan  -  3  Balkh  -  4  Farah  -  2 

Faryab -2  Helmand  -  35  Herat -3  Kabul  -  12 

Kandahar  -  2 1  Kapisa  -  7  Kunar  -  1  Laghman  -  1 1 

Nangarhar  -  8  Paktia  -  2  Paktika  -  3  Uruzgan  -  6 

Wardak  -  6  Zabul  -  5 

Total  number  of  green-on-blue  wounded  per  province: 

Badghis  -  3  Baghlan  -  6  Balkh  -  2  Farah  -  1 

Faryab  -  2  Helmand  -  25  Herat  -  1  Kabul  -  0 

Kandahar  -  43  Kapisa  -  1 5  Kunar  -  2  Laghman  -  6 

Nangarhar  -  5  Paktia  -  5  Paktika  -  0  Uruzgan  -  7 

Wardak  -  10  Zabul  -  4 

Reported  fate  of  the  attacker(s): 

Killed  (includes  death  by  suicide  attack  and  killed  after  fleeing)  -  33 

Captured  -  22*  (*  Includes  1 1  suspects  detained  in  an  incident  on  Feb.  20,  2012.) 

Wounded  (not  known  if  also  captured)  -  6 
Fled  -  29 
Unknown  -  2 
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APPENDIX  B-  AREAS  OF  ATTACKS  ON  ISAF  BY  ANSF 
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Regional  Command:  Capital 

1.  Province:  Kabul 

Total  Insider  Attacks:  6 
Total  Killed:  16 
Total  Wounded:  4 

Regional  Command:  East 

2.  Province:  Paktika 
Total  Insider  Attacks:  3 
Total  Killed:  3 

Total  Wounded:  0 

6.  Province:  Laghman 
Total  Insider  Attacks:  3 
Total  Killed:  11 
Total  Wounded:  8 

Regional  Command:  North 

9.  Province:  Baghian 
Total  Insider  Attacks:  1 
Total  Killed:  3 
Total  Wounded:  6 

Regional  Command:  West 

12.  Province:  Badghis 

Total  Insider  Attacks:  4 
Total  Killed:  5 
Total  Wounded:  3 

Regional  Command:  Southwest 

16.  Province:  Helmand 
Total  Insider  Attacks:  20 
Total  Killed:  35 

Total  Wounded:  31 

Regional  Command:  South 

17.  Province:  Kandahar 
Total  Insider  Attacks:  14 
Total  Killed:  21 

Total  Wounded:  43 


3.  Province:  Paktia 

Total  Insider  Attacks:  2 
Total  Killed:  2 
Total  Wounded:  5 

7.  Province:  Nangarhar 
Total  Insider  Attacks:  3 
Total  Killed:  8 
Total  Wounded:  5 


10.  Province:  Balkh 

Total  Insider  Attacks:  2 
Total  Killed:  4 
Total  Wounded:  3 


13.  Province:  Herat 

Total  Insider  Attacks:  3 
Total  Killed:  7 
Total  Wounded:  12 


18.  Province:  Uruzgan 
Total  Insider  Attacks:  4 
Total  Killed:  6 
Total  Wounded:  7 


4.  Province:  Wardak 
Total  Insider  Attacks:  4 
Total  Killed:  6 
Total  Wounded:  18 

8.  Province:  Kunar 
Total  Insider  Attacks:  1 
Total  Killed:  1 
Total  Wounded:  2 


11.  Province:  Faryab 

Total  Insider  Attacks:  2 
Total  Killed:  2 
Total  Wounded:  2 


14.  Province:  Farah 

Total  Insider  Attacks:  1 
Total  Killed:  2 
Total  Wounded:  0 


19.  Province:  Zabul 

Total  Insider  Attacks:  2 
Total  Killed:  5 
Total  Wounded:  4 


5.  Province:  Kapisa 

Total  Insider  Attacks:  2 
Total  Killed:  7 
Total  Wounded:  15 


15.  Province:  Ghor 

Total  Insider  Attacks:  1 
Total  Killed:  0 
Total  Wounded:  2 
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APPENDIX  C-  REGIONAL  COMMAND  AREA  TOTAL  GREEN/BLUE  KIA  PERCENT 

COMPAED  TO  TOTAL  KIA  2007-2013 


Total  KIA 
Per 

Province 

2007-2013 

G/B 

KIA 

Percent 
of  G/B 
to  total 

KIA 

Regional 

Command 

Kabul 

114 

16 

14.04% 

Capital 

Kapisa 

60 

7 

11.67% 

East 

Kunar 

119 

1 

0.84% 

East 

Laghman 

19 

11 

58% 

East 

Nangarhar 

39 

8 

20.51% 

East 

Paktia 

21 

2 

9.52% 

East 

Paktika 

101 

3 

2.97% 

East 

Wardak 

117 

6 

3.42% 

East 

Baghlan 

16 

3 

18.75% 

North 

Balkh 

17 

4 

23.53% 

North 

Faryab 

17 

2 

11.76% 

North 

Kandahar 

429 

21 

4.90% 

South 

Uruzgan 

46 

6 

13.04% 

South 

Zabul 

85 

5 

5.88% 

South 

Helmand 

961 

35 

3.54% 

Southwest 

Badghis 

35 

5 

14.29% 

West 

Farah 

47 

2 

4.26% 

West 

Herat 

31 

7 

22.58% 

West 

2274 

144 
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APPENDIX  D-  SCOPING  THE  INSIDER  THREAT 


oconcT -ncL  to  usa.  iot  nato 


Scoping  the  “ Insider ”  Threat  (U) 


Insurgent  “Insider 
Threats 

I 


Infiltration 


Co-opting 


Mimicking 


~  r 


ANSF  "Insider" 
Threats 

1 


Destablllzers 
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<0 

CTI 


e  2 
Cl  c 
u  « 
o  > 
tr  uj 


« Insurgents  who  join  ihe 
ANSF  with  the  intent  to 
conduct  an  attack,  collect 
Information,  obtain 
material  or  create  distrust 
/  confusion 

•  Insurgents  who  recruit  o' 
persuade  existing  ANSF 
members  to  conduct  an 
activity  by  using 
intimidation,  blackmail  or 
connections 

•  Insurgents  who 
impersonate  ISAF  or 

ANSF  personnel  to 
conduct  a  quick  attack  by 
using  uniforms  or  forged 

ID  cards 

•  Factors  such  as  stress . 
mental  instability,  or  drug 
use  that  cause  an  ANSF 
member  to  conduct  a 
violent  act  against 
member  nl  ISAF  nr  ANSF 

Screening  may  help 
identify  attempts  by 
known  Insurgents 


Review  ol  all  ANSF  records 
allows  tor  cross-cuing,  may 
identity  suspect  ties 


4  April  11:  Kandahar  CDO 
4  Nov  10  Sangln  Helmand 


5  Dec  10  FOB  Lightning, 
Paktiya 

10  Nov  10  Khas  Uruzgan 


Remove  ANSF  and  ISAF 
uniforms  Irom  bazaars 


16  Apr  11:  Laghman  KLE 
27  Nov  10  FOB  Rushmoro. 
Paktika 


Screening  or 
counterintelligence  may 
mdentily  past  history 

28  Apr  1 1  KAIA.  Kabul 
18  Apr  11.  MOD.  Kabul 

1 5  Apr  1 1 :  Kandahar  PCoP 
04  Apr  11  Faryab  KLE 
1 8  Feb  1 1  Baghlan  (DEU) 
18  Jan  11  Badghis  (ITA) 

15  Jan  11  Flelmand 

29  Nov  I0f  Nangarhar 


ASSESSMENT:  The  screening  and  monitoring  of  the  ANSF  has  begun  to  create  barriers  to  the  insider 
threat  posed  by  the  insurgency  and  from  within  the  ANSF.  Continued  shortfalls  and  the  lack  of 
universal  application  are  vulnerabilities  that  will  allow  some  insider  attacks  to  continue  to  occur 
against  the  ANSF  and  the  ISAF.  isjisura.**.  ***,«!«<*- 


12MAY11 


SFCBET-Rfet  TO  USA.  I6WF.  NATO 
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APPENDIX  E-  COUNTERING  INSIDE  THE  WIRE  THREATS 


Countering  Inside  the  Wire  Threats 


Provide  ANSF  and  CF  adequate  cultural  sensitivity  training 
in  order  to  better  understand  one  another 

Ensure  ANSF  receive  R&R  to  reduce  combat  fatigue 

Enforce  ANSF  unit  rotation  to  decrease  OPTEMPO 

Field  Cl  elements  to  spor  vulnerable  personnel 

ANSF  NCO/Officec  courses  to  recognize  indicators 

Establish  an  anonymous  reporting  mechanism  to  notify 
leadership  of  suspected  INS  sympathizers  with  units 

Enforce  ban  on  uniform  sales 

Ensure  accountability  of  ANSF -issued  equipment 

Ensure  proper  ID  inspection  at  ECPs  at  ANSF/CF  bases 

Fill  Cl  billets  with  trained  personnel 

8-Step  Vetting/Screening  Process 

Improve  multi-agency  background  Investigative  process 


Multilayered  defense  posture  is  essential  to  protect  coalition  and 
Afghan  forces  from  the  insider’s  threat 
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APPENDIX  E-  SCREENING  OF  NEW  ANA  RECRUITS 


Screening  of  New  ANA  Recruits 

ANA  Approach  to  Screening:  No  Single  Step  Will  Do.... 


Recruits  must  join  at  the 
location  where  their 
identity  card  was  issued 


Two  Letters 
from  Elders 


J. 


Guarantors  will  be 
identified  and 
interviewed 


Valid  Tazkera 


Recruits  with 
family  living  In 
Pakistan  and  Iran 
may  not  be 
allowed  to  Join 


t 


Personal 
Info 


Biometric 

collection 


\ 

Medical 

Screening 


•Cultural  Norms 


•  ANSF  Recruiting  Policies 


•MoD/Mol  Records  Checks 


•Information  Shoring 


MoD.  Mol.  NDS,  and  the 
Medical  Department  will 
interview  the  applicant 
at  the  provincial/district 
level 


Criminal 

Records 

Check 


Coalition  Oversight 


/ 


Drug 

Screening 


Application 
validated  w/stamp 
,rom  recruiting 
**  authority 


Full  background  checks 
on  naw  recruits 
conducted  by  02 


ANA  recruits  are  subject  to  an  eight-step  screening  process, 
supported  by  information  sharing  and  coalition  oversight 
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APPENDIX  F-  OBSERVABLE  INDICATORS 


Category  I  indicators  -  closely  monitor  situation  and/or  discuss  problems  with  individual 

•  Complains  about  other  nations  and/or  religions. 

•  Advocates  violence  beyond  what  is  the  accepted  norm. 

•  Abrupt  behavioral  shift. 

•  Desires  control. 

•  Socially  withdraws  in  some  occasions. 

•  Appears  frustrated  with  partner  nations. 

•  Experiences  personal  crisis. 

•  Demonizes  others. 

•  Lacks  positive  identity  with  unit  or  country. 

•  Reclusive. 

•  Strange  habits. 

•  Peculiar  discussions. 

Category  II  indicators  -  refer  to  counterintelligence  (Cl)  and/or  chain  of  command 

•  Verbally  defends  radical  groups  and/or  ideologies. 

•  Speaks  about  seeking  revenge. 

•  Associates  with  persons  who  have  extremist  beliefs. 

•  Exhibits  intolerance. 

•  Personally  connected  to  a  grievance. 

•  Cuts  ties  with  unit,  family,  or  friends. 

•  Isolates  self  from  unit  members. 

•  Intense  ideological  rhetoric. 

•  Attempts  to  recruit  others. 

•  Choice  of  questionable  reading  materials  in  personal  areas. 

Category  III  indicators  -  requires  immediate  action,  such  as  removing  weapon  or  detention,  as 
last  resort 

•  Advocates  violence  as  a  solution  to  problems. 

•  Shows  a  sudden  shift  from  “upset”  to  normal. 

•  Takes  suspicious  travel  or  unauthorized  absences. 

•  Stores  or  collects  ammunition  or  other  items  that  could  be  used  to  injure  or  kill  multiple 
personnel. 

•  Verbal  hatred  of  partner  nation  or  individual  from  partner  nation. 

•  Exhibits  sudden  interest  in  partner  nation  headquarters  or  individual  living  quarters. 

•  Makes  threatening  gestures  or  verbal  threats. 


Source:  Inside  the  Wire  Threats  -  Afghanistan  Green-on-blue,  U.S.  UNCLASSIFIED,  REL 
NATO,  GCTF,  ISAF,  ABCA,  For  Official  Use  Only 
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